Analysis
-
max time kernel
95s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 00:54
Behavioral task
behavioral1
Sample
FnPuller.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
FnPuller.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
FnPuller.pyc
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
FnPuller.pyc
Resource
win10v2004-20241007-en
General
-
Target
FnPuller.pyc
-
Size
28KB
-
MD5
bcc9dd0d1310bddac3a52fc95ce2bc0b
-
SHA1
bd3144b8f9c97084342fbc87c9af0e1c95b41520
-
SHA256
f0919b3ea04506a3498d7a42d792a7ac15661425884f42296b7683e08bcec228
-
SHA512
db6dc3528ab973db406f702d7f4d832b4f6ebe39f906782dd685c1a508282f386e612ddfa6c24facc831805b4d57769549844f3a56fd2c4894deafcdff15a8f7
-
SSDEEP
768:TWFBrYykyutXEH8SEQCsraKmIIF+EncA2:TlZyO+EoG6m+5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3980 OpenWith.exe